Endpoint Protection

I'm running SEPM 11.0.4202.75, on a Win2000 server with approx. 50 clients most running WinXP, 2-4 running Win2k.
I have only deployed the AV/ASpyware protection and Proactive Threat Protection.
The problem I'm noticing, and it's inconsistent between clients, is the PTP doesn't update when the AV/AS updates. Some clients have both updated to todays date (10-20-09) other vary from 10-19-09, to 10-9-09.
It doesn't seem to matter or help if I run the "Update Policy" from the client or if I log-off and back on or shut down and reboot. So far the only way I've been able to get the PTP to update to the current definitions is to push them out from the SEPM and running "update contents". Sometimes that doesn't work but most times it does.

I've seen the complaints about the "waiting for updates" which I have experienced before also but that seems to have gone away.
Is there a fix for the inconsistent updating of the PTP definitions?

Upgrade to MR5

If the issue is with the machines that have the Server OS installed on them then you should see the PTP as OFF.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008052215014748

If the issue is with the machines having XP or other OS you need to check the SEPM first because its from the SEPM that the clients pick the updates(unless you  have made any changes). If the SEPM is not conffigured properly even then you may face this issue. It could also happen due to bandwidth congestion wherein the packets are lost and thereby the definitions get corrupt. In this scenario I would suggest on one machine(the macine which does not have the correct PTP definitions) try downloading the definitions directly through the internet. Go to start>>run>>luall and hit enter. In case this resolves the issue then we can narrow down on the bottleneck area.

I'm using WinXP or Win2PRO; if my AV / AS definitions are updating daily without any problems would that eliminate the bottleneck (bandwith) issue? Are the PTP def. different (bigger)?  Some, maybe 50%, are getting both definitions everyday without issues it's just the PTP Definitions. I haven't narrowed the problem down if the same Pc's are having the problem all the time yet, except I know my specific Pc is one of them and it consistently doesn't get the PTP definitions unless I go to the SEPM and run the "update content" from there.
Does the latest software, MR5, fix this issue? 
I ran the 'update content' from SEPM server late yesterday so my Pc has 10-21-09 def's for both today.
I'll try the manual Internet update when mine gets behind and see what happens. Will I be able to run that if I have my clients setup as 'managed'?
I'm also going to track the clients and see if it's the same clients each time that gets behind.

Thanks for your help and suggestions, both.

Try by repairing the NTP..

NTP full update is smaller compared to AV/AS full update.

If you want to updates the clients from internet manually in liveupdate policy you have to select following options

1.In server settings tab use a liveupdate server (you can select internal or external liveupdate server)

2.In advanced settings tab allow user to manually launch liveupdate

Note :If you are planning to update with the help of intelligent updater it will update only AV/AS.

 

Try running live update on a client by typing luall.exe on RUN (If live update is disable on Client).

Yesterday my PTP definitions fell a day behind, so I ran the luall.exe and it updated my PTP to the current day; now both at 10-22-09.
I'm waiting to see what's going to happen today.
I'm also going to document the other clients to see if its random among them or if it's the same clients every time that get behind. Also, I'm going to try and run luall.exe on some of them to see what happens to help narrow down my problem.

Sure that sounds gr8, do keep us posted

I've got 12 out of 52 clients that are consistently not updating their PTP/TS definitions. They're stuck at their last update which veried between the clients.
I ran "luall.exe" on each of the 12 clients and now all 52 clients are running on the same ptp definitions as of 10/27/09 rev18.

The only thing that I question is the luall results after it ran. They all got the response that everything was up to date when it was done running. None of the 12 machines downloaded or installed anything. (?) Yet after approximately 2-4 minutes the PTP def's were then up to date (10/27 r18).

Is there a problem with the software 'not' reporting the correct definition file?

I took Swaminathan's advise and upgraded to R5, that hasn't helped.
Now I have some (3 Pc's) that were working fine before R5, now they aren't updating the PTP def's, some (3-4 Pc's) seem to have been fixed, for now, by the update. All in all, R5 doesn't seem to have been a benefit to my problem I'm still hovering around 10 users (Pc's) that don't want to automatically update the PTP definitions. Is there a user limit for PTP updates that I need to look at?
The AV/AS def's update on ALL machines each day without a problem. ALL the machines show (green dot) talking ot the server everyday.

Does anyone have any more suggestions?

Try by repairing your SEP installation... 

By repairing I'm assuming your talking about;
Add and Remove programs, Symantec Endpoint Protection, Change and then Repair.

I did try completely uninstalling my SEP and also running 'Cleanwipe', then doing a "fresh" install of 11.0.5 instead of the upgrade.
That didn't seem to help since my AV/AS has updated since but my PTP hasn't.

But, I will try and do a repair on a different client and see what that does.

Thanks for the advise.

I went through and did a repair on all the un-syc'd clients (11) so that ALL clients were on the latest updates (definitions) for both AV/AS and PTP.

That only lasted for one day or until there was an update to the PTP definitions to where there should have been an update made.
After one day four clients didn't update their PTP def's, after three days (holiday on the 2nd day) I lost 6 more for a total of 10 that aren't up to date on their PTP definitions. Now I'm back to my approx. total number of clients that aren't updating properly.

Doing a repair fixes them but it doesn't last, I repaired 11 clients, 5 out of the 11 acted up right away, now I have 5 new clients that have decided to not update the PTP definitions.


Does anyone have any more suggestions?

 Good luck on getting it fixed. I've been searching for answers for quite some time now. I haven't been able to successfully update PTP so I'm not going to even try deploying it. I don't understand why it works for some but not others. I've tried all of the listed fixes: Uninstall/reinstall SEP, repair SEP, delete reg keys and specific LU folders etc...and nothing has fixed the issue. Even building a new SEPM server with a brand new database hasn't allowed any clients to use PTP with updated defs.

hope they are not 64 bit or Sever Class...PTP defs has a very high tendency of getting corrupted.. 
however looking at the thing you have tried its looks your issue is something diffrent..
Is it happening on few clients/specific clients..
Any similarities between them ? Any permission right, DCOM etc issue
Anything in event viewer that can throw some more light ?
Have you tried the SEP Support Tool ( the new one) ?
All SEP related issues are very enviromental its works for some for some nothing works..

The clients I'm working on are all 32 bit Vista and Windows 7.

 I'll copy and paste from my original thread what I did to get it working on one of the clients just now.

I changed the LiveUpdate content policy to "Select a revision" for "TruScan proactive threat scan commercial application list" which lists the latest revision as 12-04-2009 rev. 018 and set the primary LiveUpdate policy to pull updates from the Symantec internet site instead of a GUP. Now PTP is showing the latest defs. I reset the option in the content policy to "Use latest available" to see if starts pulling updates correctly in the future...I'll be keeping my eye on it.

I thought I had the fix for "my" particular problem.
I changed my updates (for 3 different groups) to "pull" instead of "Push" the updates and a couple of my problem clients updated themselves without me having to run a repair on them.
I got everyone updated to the latest ver of the def's and I thought all was running smooth.
Now that it's been approx 6-7 days I'm starting to see clients PTP updates drop back off being updated daily. My last count was approx 10 again.
It seems my problem wants to hang around the number of "10" clients not updating.
It's random clients; right now I have some clients that have been updating perfectly for the last 3-4 weeks and now they just stop for no apparent reason that I can see. So far I haven't been able to spot a pattern as to why which clients act up.

It sure would be nice to get this problem corrected.

I see Symantec jumped at fixing the AV/AS def.s could they now fix the PTP update issues?

We have the same problem here.

We upgraded our SEPM to R5.  Our Antivirus and Antispyware definitions are now updating as expected.  However, our Proactive Threat Protection definitions are stuck at "31 December 2009 r20" on all clients I examine  Doing a manual liveupdate of clients updates them to a newer version of the PTP definitions.

There seems to be some confusion about this issue.  Is this a remnant of the original problem?  Will it be fixed by Symantec? We would like some official comment to put our minds at rest.

Thanks